Description
A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Published: 2026-03-29
Score: 8.7 High
EPSS: < 1% Very Low
KEV: No
Impact: Remote Code Execution
Action: Immediate Patch
AI Analysis

Impact

A stack‑based buffer overflow exists in the formSetPassword function of Belkin F9K1122 firmware 1.00.33. The vulnerability allows an attacker to overwrite stack memory through a specially crafted HTTP request to the /goform/formSetPassword endpoint, potentially leading to arbitrary code execution. This flaw directly compromises the confidentiality, integrity, and availability of the device and is classified as a buffer overflow weakness (CWE‑119, CWE‑121, CWE‑787).

Affected Systems

The only affected product is the Belkin F9K1122 router running firmware version 1.00.33. No other firmware versions are indicated. The vulnerable component is the Parameter Handler exposed via the router’s web interface.

Risk and Exploitability

The CVSS base score of 8.7 indicates high severity, while the EPSS score of less than 1% suggests low current exploitation activity but publicly available exploit code exists. The flaw is not listed in the CISA KEV catalog. An attacker can remotely exploit the issue by sending crafted requests to the /goform/formSetPassword endpoint, with no local privileges required. Consequently, any network that exposes the router’s web interface to untrusted users faces significant risk.

Generated by OpenCVE AI on March 30, 2026 at 21:05 UTC.

Remediation

No vendor fix or workaround currently provided.

OpenCVE Recommended Actions

  • Apply the vendor-supplied firmware update that addresses the formSetPassword buffer overflow.
  • If an update is not yet available, block or filter HTTP access to the /goform/formSetPassword endpoint using a firewall or ACL.
  • Restrict management access to the router’s web interface to trusted internal IPs only and disable remote administration if not needed.
  • Monitor network traffic for unusual POST or GET requests targeting /goform/formSetPassword and investigate any suspicious activity.

Generated by OpenCVE AI on March 30, 2026 at 21:05 UTC.

Tracking

Sign in to view the affected projects.

Advisories

No advisories yet.

History

Mon, 30 Mar 2026 19:00:00 +0000

Type Values Removed Values Added
Weaknesses CWE-787
CPEs cpe:2.3:h:belkin:f9k1122:-:*:*:*:*:*:*:*
cpe:2.3:o:belkin:f9k1122_firmware:1.00.33:*:*:*:*:*:*:*

Mon, 30 Mar 2026 16:15:00 +0000

Type Values Removed Values Added
Metrics ssvc

{'options': {'Automatable': 'no', 'Exploitation': 'poc', 'Technical Impact': 'total'}, 'version': '2.0.3'}

Mon, 30 Mar 2026 07:15:00 +0000

Type Values Removed Values Added
First Time appeared Belkin f9k1122
Vendors & Products Belkin f9k1122

Sun, 29 Mar 2026 11:30:00 +0000

Type Values Removed Values Added
Description A weakness has been identified in Belkin F9K1122 1.00.33. The impacted element is the function formSetPassword of the file /goform/formSetPassword of the component Parameter Handler. This manipulation of the argument webpage causes stack-based buffer overflow. Remote exploitation of the attack is possible. The exploit has been made available to the public and could be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way.
Title Belkin F9K1122 Parameter formSetPassword stack-based overflow
First Time appeared Belkin
Belkin f9k1122 Firmware
Weaknesses CWE-119
CWE-121
CPEs cpe:2.3:o:belkin:f9k1122_firmware:*:*:*:*:*:*:*:*
Vendors & Products Belkin
Belkin f9k1122 Firmware
References
Metrics cvssV2_0

{'score': 9, 'vector': 'AV:N/AC:L/Au:S/C:C/I:C/A:C/E:POC/RL:ND/RC:UR'}

cvssV3_0

{'score': 8.8, 'vector': 'CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV3_1

{'score': 8.8, 'vector': 'CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:X/RC:R'}

cvssV4_0

{'score': 8.7, 'vector': 'CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P'}

Subscriptions

Belkin F9k1122 F9k1122 Firmware
cve-icon MITRE

Status: PUBLISHED

Assigner: VulDB

Published:

Updated: 2026-03-30T15:56:42.019Z

Reserved: 2026-03-27T16:35:46.876Z

Link: CVE-2026-5043

cve-icon Vulnrichment

Updated: 2026-03-30T15:56:36.994Z

cve-icon NVD

Status : Analyzed

Published: 2026-03-29T12:15:57.937

Modified: 2026-03-30T18:57:49.380

Link: CVE-2026-5043

cve-icon Redhat

No data.

cve-icon OpenCVE Enrichment

Updated: 2026-03-31T20:00:32Z

Weaknesses